25ad3d0cfb4233ef3517965a33a3ae07e00b8e4214c42c426fe15ccafc3e45fc

Analysis

user interaction
yes
max time kernel
151s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jinstall.exe
Size 102.6MB
Sample260701-qlz8vae15k
SHA256 25ad3d0cfb4233ef3517965a33a3ae07e00b8e4214c42c426fe15ccafc3e45fc
MD5 0e651c2994ae01483386e5da90856ea8
SHA1 06501064c03a6cfc208e1a4aa514716c46fec30a
SHA512 9fc42737b76d1a7d045b6bbf709a7af17433651c19b2dfa5dd45655f5ff135b0ad8a9f2ae9b0394fa66a39d07e60a2745684ab8f333adaa479be5b03fd9a4871
SSDEEP 3145728:5F5ZaMyf58fyQmjH/C0MRP7nSA+Hpf8YEVbrft:Tr6h8fBmjfCAtE7t
TLSH
T1213833D1FDE8AE85ECB1B5B91822A237323559BCC172C6A3739173E319220F958B454F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 49 IoCs

pid	Process
4860	installer.exe
5332	jrewin.exe
4116	javaw.exe
3172	JExpressWinAPI-x32.exe
2344	JExpressWinAPI-x32.exe
5852	JExpressWinAPI-x32.exe
5020	JExpressWinAPI-x32.exe
1448	JExpressWinAPI-x32.exe
1304	JExpressWinAPI-x32.exe
3712	JExpressWinAPI-x32.exe
1844	JExpressWinAPI-x32.exe
3608	JExpressWinAPI-x32.exe
3176	JExpressWinAPI-x32.exe
5532	JExpressWinAPI-x32.exe
5840	JExpressWinAPI-x32.exe
5172	JExpressWinAPI-x32.exe
1700	JExpressWinAPI-x32.exe
2596	JExpressWinAPI-x32.exe
3060	JExpressWinAPI-x32.exe
1320	JExpressWinAPI-x32.exe
3400	JExpressWinAPI-x32.exe
2880	JExpressWinAPI-x32.exe
3852	JExpressWinAPI-x32.exe
616	JExpressWinAPI-x32.exe
2172	JExpressWinAPI-x32.exe
5104	JExpressWinAPI-x32.exe
1284	JExpressWinAPI-x32.exe
476	JExpressWinAPI-x32.exe
3760	JExpressWinAPI-x32.exe
3096	JExpressWinAPI-x32.exe
5964	JExpressWinAPI-x32.exe
1660	JExpressWinAPI-x32.exe
2420	JExpressWinAPI-x32.exe
3428	JExpressWinAPI-x32.exe
5884	JExpressWinAPI-x32.exe
4156	JExpressWinAPI-x32.exe
3608	JExpressWinAPI-x32.exe
428	JExpressWinAPI-x32.exe
2788	JExpressWinAPI-x32.exe
3008	JExpressWinAPI-x32.exe
1788	JExpressWinAPI-x32.exe
3708	JExpressWinAPI-x32.exe
1444	JExpressWinAPI-x32.exe
1832	JExpressWinAPI-x32.exe
5496	JExpressWinAPI-x32.exe
908	JExpressWinAPI-x32.exe
5940	JExpressWinAPI-x32.exe
6068	JExpressWinAPI-x32.exe
4936	__cleanup.exe

Loads dropped DLL 11 IoCs

pid	Process
4116	javaw.exe
4116	javaw.exe
4116	javaw.exe
4116	javaw.exe
4116	javaw.exe
4116	javaw.exe
4116	javaw.exe
4116	javaw.exe
4116	javaw.exe
4116	javaw.exe
4116	javaw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jrewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JExpressWinAPI-x32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4116	javaw.exe
4116	javaw.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 4860	1884	jinstall.exe	87
PID 4860 wrote to memory of 5332	4860	installer.exe	88
PID 4860 wrote to memory of 4116	4860	installer.exe	89
PID 4116 wrote to memory of 5400	4116	javaw.exe	90
PID 4116 wrote to memory of 3172	4116	javaw.exe	92
PID 4116 wrote to memory of 2344	4116	javaw.exe	95
PID 4116 wrote to memory of 5852	4116	javaw.exe	97
PID 4116 wrote to memory of 5020	4116	javaw.exe	99
PID 4116 wrote to memory of 1448	4116	javaw.exe	101
PID 4116 wrote to memory of 1304	4116	javaw.exe	103
PID 4116 wrote to memory of 3712	4116	javaw.exe	105
PID 4116 wrote to memory of 1844	4116	javaw.exe	107
PID 4116 wrote to memory of 3608	4116	javaw.exe	109
PID 4116 wrote to memory of 3176	4116	javaw.exe	111
PID 4116 wrote to memory of 5532	4116	javaw.exe	113
PID 4116 wrote to memory of 5840	4116	javaw.exe	115
PID 4116 wrote to memory of 5172	4116	javaw.exe	117
PID 4116 wrote to memory of 1700	4116	javaw.exe	119
PID 4116 wrote to memory of 2596	4116	javaw.exe	121
PID 4116 wrote to memory of 3060	4116	javaw.exe	123
PID 4116 wrote to memory of 1320	4116	javaw.exe	125
PID 4116 wrote to memory of 3400	4116	javaw.exe	127
PID 4116 wrote to memory of 2436	4116	javaw.exe	129
PID 4116 wrote to memory of 2880	4116	javaw.exe	131
PID 4116 wrote to memory of 3852	4116	javaw.exe	133
PID 4116 wrote to memory of 1836	4116	javaw.exe	135
PID 4116 wrote to memory of 616	4116	javaw.exe	137
PID 4116 wrote to memory of 2172	4116	javaw.exe	139
PID 4116 wrote to memory of 5104	4116	javaw.exe	141
PID 4116 wrote to memory of 1284	4116	javaw.exe	143
PID 4116 wrote to memory of 2144	4116	javaw.exe	145
PID 4116 wrote to memory of 476	4116	javaw.exe	147
PID 4116 wrote to memory of 3760	4116	javaw.exe	149
PID 4116 wrote to memory of 3096	4116	javaw.exe	151
PID 4116 wrote to memory of 5964	4116	javaw.exe	153
PID 4116 wrote to memory of 1660	4116	javaw.exe	155
PID 4116 wrote to memory of 5388	4116	javaw.exe	157
PID 4116 wrote to memory of 2420	4116	javaw.exe	159
PID 4116 wrote to memory of 3428	4116	javaw.exe	161
PID 4116 wrote to memory of 4812	4116	javaw.exe	163
PID 4116 wrote to memory of 5884	4116	javaw.exe	165
PID 4116 wrote to memory of 4156	4116	javaw.exe	167
PID 4116 wrote to memory of 3608	4116	javaw.exe	169
PID 4116 wrote to memory of 428	4116	javaw.exe	171
PID 4116 wrote to memory of 2788	4116	javaw.exe	173
PID 4116 wrote to memory of 3008	4116	javaw.exe	176
PID 4116 wrote to memory of 1788	4116	javaw.exe	178
PID 4116 wrote to memory of 3708	4116	javaw.exe	180
PID 4116 wrote to memory of 1444	4116	javaw.exe	182
PID 4116 wrote to memory of 1832	4116	javaw.exe	184
PID 4116 wrote to memory of 5496	4116	javaw.exe	186
PID 4116 wrote to memory of 908	4116	javaw.exe	188
PID 4116 wrote to memory of 5940	4116	javaw.exe	190
PID 4116 wrote to memory of 6068	4116	javaw.exe	192
PID 4860 wrote to memory of 4936	4860	installer.exe	194

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1836	attrib.exe
2144	attrib.exe
5388	attrib.exe
4812	attrib.exe
5400	attrib.exe
2436	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jinstall.exe
"C:\Users\Admin\AppData\Local\Temp\jinstall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\tmpjex01\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpjex01\installer.exe" installer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\tmpjex01\jrewin.exe
    C:\Users\Admin\AppData\Local\Temp\tmpjex01\jrewin.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5332
- - C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\javaw.exe
    javaw.exe -Dsun.java2d.d3d\=false -cp .;install.jar com.denova.JExpress.Installer.JExpressInstaller
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +H "JExpressWinAPI-x32.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe envvar PROCESSOR_ARCHITECTURE C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe envvar PROCESSOR_ARCHITECTURE C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe windir C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3400
  - - C:\Windows\SysWOW64\attrib.exe
      C:\Windows\System32\attrib.exe +h C:\eSubApps\eSub_v3\JExpress /s /d
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe menusdir allUsers C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe windir C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3852
  - - C:\Windows\SysWOW64\attrib.exe
      C:\Windows\System32\attrib.exe -r "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FDA Submission Software\eSubmitter v3.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe programsMenu "C:\Users\Admin\AppData\Local\Temp\tmpjex02\specmenu"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:616
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe programsMenu "C:\Users\Admin\AppData\Local\Temp\tmpjex02\specmenu"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe desktopdir allUsers C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe windir C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1284
  - - C:\Windows\SysWOW64\attrib.exe
      C:\Windows\System32\attrib.exe -r "C:\Users\Public\Desktop\eSubmitter v3.lnk"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe desktop "C:\Users\Admin\AppData\Local\Temp\tmpjex02\specdesktop"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:476
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe desktop "C:\Users\Admin\AppData\Local\Temp\tmpjex02\specdesktop"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe appdatadir allUsers C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe envvar PROCESSOR_ARCHITECTURE C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe windir C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1660
  - - C:\Windows\SysWOW64\attrib.exe
      C:\Windows\System32\attrib.exe +h C:\ProgramData\JExpress /s /d
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe envvar PROCESSOR_ARCHITECTURE C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe windir C:\Users\Admin\AppData\Local\Temp\tmpjex02
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3428
  - - C:\Windows\SysWOW64\attrib.exe
      C:\Windows\System32\attrib.exe +h C:\eSubApps\eSub_v3\Uninstall.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:428
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:908
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
      C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe registry C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6068
- - C:\Users\Admin\AppData\Local\Temp\tmpjex01\__cleanup.exe
    __cleanup.exe C:\Users\Admin\AppData\Local\Temp\tmpjex01
    3⤵
    - Executes dropped EXE
    PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__jextest.zos

Path C:\ProgramData\JExpress\__jextest.zos
Size 4B
SHA256 9f2a59a60e65fbcd5a3e1b7248adf92890ce3a32b19e43fb4751c2657196de13
MD5 d3accd33402becc720abebee93ebe193
SHA1 7362b81a747f7e757e03d0c4d2e20822d7f52bf5
SHA512 4becf1bca4f0375aa0262b27fd05d35c8868d0d79b2ead2d815eb3caff11a913516e7b9461094d9a0b61b33d6995c3947681222f35e93322862d2675bbab1a12
MD5 SHA1 SHA512

Submit Download

JExpressWinAPI-x32.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\JExpressWinAPI-x32.exe
Size 204KB
SHA256 fee1a7b2f6d0f4dd9a3134b4bd9fde87ead0f96205eefc3c14f9376fe010bf43
MD5 64d7b4da5e0bc7e06bf7c8f70f4d0142
SHA1 7d79baa8275b3ec6d0aca4ec9ad5cfe468cb1cb9
SHA512 8681b63fc715079d0b868729bc60521aca017e4d58584ed358256e87f077086cb30831125f3c598c6d345adbd82ae620edc9e348c8e50ca0573f6e5a5b5da28e
SSDEEP 6144:TaCgBloS8lFG1Gtk48I25MiFN1zvNVAytNmOdT2GusIKpvrv/5T3Eoj7F0PD4cER:tgRGtk4K
TLSH
T1D614F792BBC49DEBD91A037888E6C311933EF6E047138B478B2845355B637D2BDC5A46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__jex_user_name.txt

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\__jex_user_name.txt
Size 7B
SHA256 983047a7aa4ffe591637bb8c941f11134c1af34bc6b6f8291f389833be49406f
MD5 2af264b99ff1d93e9477482ed9037db8
SHA1 710a2c6788513dc1aa4f7df778ba6fad5a69170c
SHA512 fa7b2edc03b2e336cb12bb9b770912cf7b6c05aa14735eae50518a06eeca1afb9390e74116c86b092c9fd4a37e073131d9b47d5d72a70d3ffe462c811682d55b
MD5 SHA1 SHA512

Submit Download

cleanup.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\cleanup.exe
Size 131KB
SHA256 36b8492cf31d7d61d734f1fab491b9f0d7b688e0f24d455ed52ec966746731f6
MD5 ddba91f5bbb122f0ce104a7808a08387
SHA1 2789d599c9786789fb8bbca0d7ad55b1f08cc362
SHA512 3d0c714b73ebe3b5dd1605256ccda817dd25cf513bc1ba85546b74ce80198d264a90dfcbd53172780105dd8df04c333e62dfb2b1d438c486c8b86c861e3c7056
SSDEEP 1536:ojhfB0OhyUXBMhIbLF0zJAiaKmU1NAZPa/9vlwEt:otfBRhtROCyz+YX3/RlwEt
TLSH
T1C6D309E6BF969E8BD611077C4CF69325133EF5D00B878B172A64883A0F53BA17EC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\installer.exe
Size 454KB
SHA256 52c4871eae8a1fa4233a3914e61d9c77c56dbecffa172886825e6fff082d0623
MD5 7278bd6b18fedb6a17b5f71033a9a353
SHA1 d968ff1995d39c9ede328550e1d2f7700b1770ff
SHA512 b924126291f93b7ec307aea68fb6f592e9864207692c5b5830df623338dc72d66ced60e1078fa602b57ffaae118bc224157287cecacd8a865fec2d6ecb5b8074
SSDEEP 12288:WomTV5Z9kPefTBwmXy5yHpVJ4cM/WmiSZi:Woi9kPeflwmX8oFM/WmiSZi
TLSH
T129A44C93B6D55CEAEA16433945D7D3332339F9805322AF1B2A209B320E13DD07F9765A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jex.control

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jex.control
Size 5KB
SHA256 2adf55f607ecdf4f0d60e7194df92aec23b28beec7290a5d6bd1a3a3471531cd
MD5 75a4669b101510525b6da39e153abf5d
SHA1 c061f542953f82e86e655e89d5fbf74068e22d8f
SHA512 3e397253a996bbce4787f09862c5af851faef7fcc9709dabbc0c67f63a874de77ab5ee0bd8447ff98276a1c2030d9495655dac6e20f253e17319686902164ccb
SSDEEP 96:ognab9RkaH0YqXLilYbQkU/yYXxH6SmwphcHGTS1mVizdf2/sDMRAXnsGUO:Fna5pH0YqXLilYbQk1Y9qgOHrmVizdfH
TLSH
T18FC1ECD0E8418AFDB2772FC5D6C61481051231EE392FAE7ED8B16135127B87C0A6995B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinstall.log

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jinstall.log
Size 2KB
SHA256 2474d1edae40797a9df3ad7e3b3c8288e82225f86e785ff693527004fea2816e
MD5 12e7a3d1ee4d410c00e87617747d3f1c
SHA1 cff4443e51edfac0ba054a86baa6ef8b9130d50a
SHA512 da9e1002870bbe985c37f24cfc5e80977cb89fd18e1051d5f872f3ea932cac294e8838defc079a1c92f97a96805788ffc2e0cc69a6f576bb0f78a2014b783f44
TLSH
T15751F5CA678743A4F90461AACAD3FBDD41D1069F172EDD9CA2A4B00D2953C1D6BDF212
MD5 SHA1 SHA512 TLSH

Submit Download

jinstall.log

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jinstall.log
Size 4KB
SHA256 9cdf6f743cb7310e35bb84c2143978205797692727a5fb692717eb9768c90c29
MD5 533d95e062d69d2632f60e2b2c2b57c7
SHA1 eca61d9e9d7bb72002a797a2a8b2b098a50d8ae5
SHA512 912a5fd5ad30b7336d5bef97cb6fcd2a8e81f37ff486122404516a0a0c7109c42d1245a810e69e3de922b5fd5ba7bb98f63f312da7089c51c72eb2285bdbff87
SSDEEP 96:iNU/AB/lvvLCG5YR/JDvzmynogAxZGnuwbATckfD6N8N3TfaNRWtBWNPhBdwBcBF:OPoh/1yMlu+KafATVW
TLSH
T10191068E668383A4E90560E6C9E7FADC41D1069F172DDE9DA7E8B00D2913C2D6BDF112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrewin.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jrewin.exe
Size 45.5MB
SHA256 aaded428aa5223d653a09d6c9cb003439ca28ae6256eb6bd5b1259a6fdfe4d2f
MD5 10447c614a1dcd5f28b0c1d7508e0b71
SHA1 32f2afbcea3e5093db1115c5044fdd7e9a8ef837
SHA512 8495ad297b3c1acc8cb16453f38ffc3e5139c57bfaf80c7ea063f30a997a9602ff92ac3a2030291e939683901f676ea514671899f7f45ba864325da326edb598
SSDEEP 786432:XGucGXfh5fq3VdKfHnvhRzLY/9L8I8km4cc4yKuQ4rMpts7hatI:XNjfh5SqfP64jvuQcJhatI
TLSH
T153A73384BA90EC48FC66A0B4C851E6FE51A82CE4D7B2875B67E43ED735329D050F81B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\ASSEMBLY_EXCEPTION
Size 1KB
SHA256 a44eb7b5caf5534c6ef536b21edb40b4d6babf91bf97d9d45596868618b2c6fb
MD5 d94f7c92ff61c5d3f8e9433f76e39f74
SHA1 7a9b074ca8d783dbe5310ecc22f5538b65cc918e
SHA512 d4044f6ceb094753075036920c0669631f4d3c13203caf2bea345e2cc4094905719732010bbe1cae97bc78743aa6def7c2aa33f3e8fca9971f2ca0457837d3b0
TLSH
T1F7311F3AC2441A7346C314625E1825DAE39F5C2D3F900570B85CC2CD1695A35E33B7E7
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\api-ms-win-core-console-l1-1-0.dll
Size 15KB
SHA256 01257dbf5f6ac3d8b948fcbf6afe32e21b9477dffa324e12158941d0d723de02
MD5 4a268ac7347157459ec4a46c7ca30121
SHA1 c942985141613a27dca9a49e5b8fc817f7a6ca8a
SHA512 d9c0938cb2c7b766daa4f925970f6bd2755f49bba80bdd4af26c7714027478f81dd809a526f861a1144db39e7ae91f780f9eddde67603493bcc131f0ba714193
SSDEEP 384:pW2hWuZSf+VIYiRvcVu6ubpKSJIVE8E9VF0NyjY:HI/YiR0VuZF72E6
TLSH
T131626C538EA85C01DC5B8F71B5D5C937AA79BA028D90C1C6321AC2598BD67027FE83FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\api-ms-win-core-datetime-l1-1-0.dll
Size 14KB
SHA256 5a8ee39ba341ce3bb1a3548f3a4c3c2e6adc5690121a67228bff924eed12b04a
MD5 09bf6c4b73d99494f7c36da2774aae8a
SHA1 5d6a753e315f5e0149f4bc4665043c5f6b4bf32f
SHA512 23290eebfa90b16a69a731c58b12d5e497f28c1133db4aba53e62e74cbdb263b02b86486430aa1aeedcf0f69241c9579050e66cdbc9b9f85171db0f7c427a1be
SSDEEP 384:ZZW2hW7ZSf+VIYiRvcVuX1QSJIVE8E9VF0Ny+F:F3/YiR0VuX1R2E2
TLSH
T12C624B5387A85C02DD6B8F7071E48936AB79B6129DD0C2C7221AC2548B967027FF93FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\api-ms-win-core-debug-l1-1-0.dll
Size 14KB
SHA256 746db9eb6c44caf4591e2f63a0364162499086e524ec09179c86454ef0a74288
MD5 1a2f29609fed07edea0d072823011831
SHA1 fedc5a923f6535d432323d81ad2ee27ff2df8919
SHA512 44704b85cb4bf4c88b970f2b0d654e3d2c364e5b970f27a5d73552bd713d6576306fad156f00a3d040c76fb31f6a59fa0b07800245e30f767ec6c3da68b47b35
SSDEEP 384:HvW2hWuZSf+VIYiRvcVuvEJ4SJIVE8E9VF0NybhxH:HRA/YiR0Vuy2E/xH
TLSH
T1CB625D52CBA45C01DD6B8F71B1D48A3BAE747A424D90C2D6230AC2558B927427FF93FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\api-ms-win-core-errorhandling-l1-1-0.dll
Size 14KB
SHA256 abfa7da3144dfbdf9e01ace360210ae2e2f308830cfe9324d1cce16803b0cd19
MD5 4cc6c71870b961758e4a8c58a4663383
SHA1 4b64bd88afe019dcd5028b2dedb03c4929a930c1
SHA512 b772b358806166259de2d5cd93885491992a9c920b2817f91973ef9f181d7e90e69f4f8ccecf1ca44be2bb1cf9444b099e466b8b38068f4da32bd6c8f16c2a41
SSDEEP 384:e70W2hWvHZSf+VIYiRvcVunnSJIVE8E9VF0NyYRV:e7o//YiR0VunG2Ee
TLSH
T132625B538AA85C02ED9B8F74B1E4C937AA757A418D90C1C6230DC2154B96302BFF97BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\api-ms-win-core-file-l1-1-0.dll
Size 18KB
SHA256 df20e8700aafc8f6d1456c60cc4653498f62289c97b0362704998f68c1d6befa
MD5 cba44f73bf3e35d7d39521e7ac15f2af
SHA1 1e437c6c1985978c61d76cb838c28e3ffdc9dd99
SHA512 1aad5e5f27dc0b040349deb67e293e23a362cc6c1ab3d34e23d6d806059d742cc9709601d53134583767d76c840410d1ea2cd63f9d84daad2819a58c69306ebc
SSDEEP 384:bPvVXfW2hWaiZSf+VIYiRvcVuL8xSJIVE8E9VF0NyZT:bPvVXBrp/YiR0Vuv2E
TLSH
T109821B53C9A0BD1AEC8F8F3670D28826993562424464C5C76399835DAFE7306F6EC6F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\api-ms-win-core-file-l1-2-0.dll
Size 14KB
SHA256 369d6a88d882b7d38682fb7602688cbf8e30ce908ea6145e48c747aa21838e7d
MD5 fe7f538fccb88173f58ffd2a463d5811
SHA1 1a83e8c468e0d331d90fd07302774b671687d1c2
SHA512 993274a6602509989a984063ed572785325d5077ff15da6d1e6005184e588843bb2e725fe82b32713f23a6b6a01c507b855c28afd83e9d7f01eeff165164d60c
SSDEEP 384:JW2hWepZSf+VIYiRvcVuDSJIVE8E9VF0NyiK+:nO/YiR0Vua2EN+
TLSH
T1AE625C5387685C05DDAB8F70B1E9893BAA78B6018DD0C1C2221AC2554B92742BFED3FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\api-ms-win-core-file-l2-1-0.dll
Size 14KB
SHA256 faca4042b58c9acf26034cc4b0302450b672fd451aa1649aa078ffe37903343e
MD5 d87d6f5780f07e179db8c1474d967463
SHA1 f412429dc5272435cd71055dea4421e7b7917ab4
SHA512 15bb6ddb1c799814f927d07ffe4aff61106ff09eceb3ed19603be8ba852c54153ffcca00bbf6fca396930c214899f4f9fc17a711f99352fcec8333b55468932f
SSDEEP 384:BUW2hW/ZSf+VIYiRvcVuVnCbSJIVE8E9VF0NyWNyi:BI//YiR0VuVX2E4yi
TLSH
T1B8624B9286945C01ED5B8F3171E58A3BAA79B6429DD0C1C7231AC2148F963427FF93FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\api-ms-win-core-handle-l1-1-0.dll
Size 14KB
SHA256 024b03c66ce1b352241cdecdb5d08fcc945068ab23f6e58204e153f0edc06fa3
MD5 059fbf5ea2f0f82253a202bf1d22b6eb
SHA1 67981620d48a84d3a34bfc1191dbec06eed83243
SHA512 31d28dd25daf2b7abf2e25433f39de08773d8288bc6acc3496f49e1c5121502a2f794d4f532ee07e490ef3e14bb33606c17cf5d89797c2f7377b83af65cc2d67
SSDEEP 384:oW2hWwZSf+VIYiRvcVuOdSJIVE8E9VF0Ny8a:8e/YiR0VuO82E7
TLSH
T117624B62C7A85C02ED5B8F31B1D48637AE7876019DA0C2D7231AC2554B96342BFF93BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\api-ms-win-core-heap-l1-1-0.dll
Size 15KB
SHA256 8d9b43604335aedca63aeab804cdd3898943e5bbf1dbd42b1d99bc52b08ea9ac
MD5 5df860a6cf59d7f2d700b5755ce1d926
SHA1 f5eab962915fa123b48e012e6051d844ab1d649c
SHA512 9588c9f2b7a880b115c0dc133c53bcb42ff103310a7f529d334a1c2981d271a8d7a4ff8280356404d348d98a242931ee72527dfd32e072cf73d5b0a1206c64e4
SSDEEP 384:1l6W2hWGZSf+VIYiRvcVusMSJIVE8E9VF0NyBlX:CA/YiR0VuC2ENX
TLSH
T172625C5AC6A81C02ED6B8F3171E1893AAAB976414990C5C3131AC2558BD5702BFFD3FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\api-ms-win-core-interlocked-l1-1-0.dll
Size 15KB
SHA256 95d4c6573b05370f38a76d60b4bcef074f485e9e9a2862190fcac6dfa48c552a
MD5 1698c26372514794613b9c06904671be
SHA1 be71116a769654ef05349f24e46b7cbfa983a51d
SHA512 54a7c50bdf256341af10cb5806599b0bcaa266df7ea4d3a361e6e900dab6f022b0293792565dea4b1da06a667c832f7c6f2f8321898642db4da06322fdf7216f
SSDEEP 384:+vlYsFeW2hWEZSf+VIYiRvcVu2vSJIVE8E9VF0NylB0:+iW/YiR0Vu2e2ES
TLSH
T1CE625A5286A85C06EEAB8F3671E489369E7976019990C1C3131AC15887DF742BFF83F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\awt.dll
Size 1.2MB
SHA256 4da7063b7ed752b20a08be71eafa8770ba2056c4342d9a906b5b8b4b69cacf5c
MD5 f7f7ef63393729471f3f0f21dd6eba25
SHA1 6202e7af27d9dea508b40f175bdd54b9c26ff2c9
SHA512 4c91060e6f6063b9ea89e424ec5cb2c4b39ad92dabb5ed7ee75f564d0fb2a49438d2dbac6650a38f9a50396a9ad58ea4c6e8ae483c03770008cfe2c0ca68ab95
SSDEEP 24576:oV+bj+KdX5eB7BGMA/wqkmZziUGm3pKmqNvvHfcU4L0yMtjNBHPU0yir2VpRNKHT:XPPYpBvUMr2XRNKHr/
TLSH
T190459E42A6C290B3F44E2630365BF72F1776BB440B1AC5D7BAD46B5E5D313E11A3328A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontmanager.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\fontmanager.dll
Size 245KB
SHA256 289ee8379bfba58f0de799636eec1414793cf39ef5dcbdf12fb1df9c8a62f1e8
MD5 0186c1bf92fad66a2e333f552e55ae95
SHA1 be45ac1547eca68b13986f4f3ec58f9ecba9d616
SHA512 2c9b152e86b4a4567264081cbd8ddc7fd4a21137007652d9848d9c76beb5ee243fd54412d75543dce782e363db865d2dabdd65b5582d154121feae64776a5f7a
SSDEEP 6144:96v151Kei7JSNt7vDdDHFGMReiDTluD1HPc:96v151dyJSDDdDlGSURPc
TLSH
T1D2346CA1FA8716B0FEEE1434207B6B3E52359B058B05DAC7C3612EC8193F7D16AF6194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freetype.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\freetype.dll
Size 554KB
SHA256 96bef2d91a1aec35bd978f88a34e6ee1bd8fda5ccda4db023ea0c24bd9a4d33b
MD5 9508fde163791f365dcb09e47c2f7106
SHA1 9ffa7714dd3384e12350ef3ed430d4aacd054eee
SHA512 1f4ac3bac4aa4aad1d0461205a7c971d1a16eae5da6c66d332eae45f7933e6a83862dba62d0e0304c3e3c9cde7e5b906e3fcb0bc5b1daadbf53d060846a49329
SSDEEP 12288:qMoSKd0FyOfqBCRXhv6f6jWycKhT1w+vfEWmXKRPQ:qEFBMIhSf6jCKkZau
TLSH
T123C49E22B9118026E8D20172D3BE9B761E3D8335131991DBA6E41CFDAB249E3B73D717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\java.dll
Size 141KB
SHA256 f2e4d8f5b085954daf07bf953d049359a70060962d1c24a54b195b8c8576051a
MD5 87407b76c56f9b88f66e9c305003d668
SHA1 76b849de4e6dc896949e34514a58cae63204f98d
SHA512 c691817bf1b88ef662e19e89ccc8fba084d3ab03274859be7d9361b507290b7b8981828859b8ae084d9288a851e2dedd40584deb006ba36b52129f7ce01c72cd
SSDEEP 3072:7IqaOw4LY5pF1lBtYENfQl8fRYqN3GztYsr3c58JTxzOr/3L:7ItOZLY517tGvozufzYPL
TLSH
T106E36C0373B4D05AEAF1387C242DBB3DB2BA9628B0FCD9831B204559559E2326D377E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\javaw.exe
Size 245KB
SHA256 e676a60567a930ab76af920c7f99c643ca42c05bde07d65a03eb68f96a99d899
MD5 3ca29688b80f9fccfc5ddb130b21d3a1
SHA1 93b978371a33f38f3ea19eed36360514fea325f6
SHA512 a36df4b027c1877ced260a76eb9ea043cae6b2c0db9081dcef394b72459f337bb1a7e3fb5c2b6029b21b0a1417e6ac4db0d00a2116ebc9d1ea35d31e7c71e00f
SSDEEP 6144:jQuv7wA+t8Q//plt0Ff4Rbl90ohI/STojW7k/sYkfP7:3Be8Q/hEfObdIamp0YkfP7
TLSH
T14934BF61788194B1D472143504F1F7720A3DFC311EA49A9BAFC867798F312D2963AAEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\msvcp140.dll
Size 438KB
SHA256 0399e698bda394bf44adc9aed330868672944fce5964018b648a548ebfe1c51f
MD5 f41c0a2272d10b1a28b50779b264eabb
SHA1 677159d95f42f01cb4d2cafdcc672829a8631985
SHA512 d66db8de3dedfa98ad154ba1b38b98ca0fa2319253c4ccd4306ec75c28620802d127422f37e8c8f6b748f3fba7c38439a234835718ae2bfc9768a23aeed27f4c
SSDEEP 12288:R2Pa9C9VbL+3Omy5CvyOvzeOKxqhUgiW6QR7t5s03Ooc8dHkC2esGJW10Pb:R2Pa90Vbky5CvyUeOKr03Ooc8dHkC2eh
TLSH
T1A1A43922BB424DF2E59E53B671C6532187F5FC250760E3C393EAE0296F662C26733691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\net.dll
Size 90KB
SHA256 980d62e61b38b91385dfe5313c21198b0743e758bc7a36716e592367e6a512ae
MD5 d28fb85f74ec41cc55ad263a848b0678
SHA1 63d0afed29bb50cc1819e235cc01322a36cf8e19
SHA512 d5446dd5ec110650dccb2b6d10d644c117ef463fd13dd426e787a70e3819b7d143b28a1618097d0dca04bca404e374ba0c84b5bcb7663041f441b8cf73de4dc9
SSDEEP 1536:P/aYZ6IjuQKlvYeHYpZeDUV3HHWIxA+R6GxxOkyoRIjQpj/d/7OArwS:P56GuhlvN4pZeDUV3HHPOGrWjQp7d/3f
TLSH
T1E6938D03F6D494D7FFB228303199AB7B913A6430F850AEC3431699524DBF7A5B936782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\nio.dll
Size 58KB
SHA256 d399173f764cb85fbc584c2112163935b48636d1d58577cf229ce88a65414f78
MD5 7d54bbd1ccea8ff46a92f5d1f008836e
SHA1 f4b99177ed4bcca2d6e50da879729d60961bbbc6
SHA512 9c38b99c858afc14cd113aab651bead39c696239382fff1a916c90fbc9c3656cad9f2a8901b99c4fd43fd25769bad7b4f99342d5c7c3071f208ab0c1109c39f2
SSDEEP 768:roawLKx7PUHTdFHSEtYjaAKfHdKMplc3KSUbkH8qQMh+VgVoDqNHSL/YiR0VulJv:roawWap5BtY2c5cqrhODaHU/7OAlJFGe
TLSH
T114432C728350CC93DBB13234766E269C7326E8109420AB5B53124761DC5FAB3BA3FAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\server\jvm.dll
Size 6.1MB
SHA256 c050adc7f44c7a33f17f5699f44e215845864c2191768ad7c0c91cdd0732a5c3
MD5 66c9b143404d04045cf01e76fb6ce098
SHA1 0dbb6d147fa07045b2df84e520c560bdc1eb351f
SHA512 a88da78f43f5e1a9721a1f74c7f16f6af0d6ca55555ef371914ca95ea00cb1ff6c0452c699e1fe5b106cb8a233ca3190b82435496b973e78d9b095ebcf74f6ec
SSDEEP 98304:7FE4fy9+IuSYhVE5/faiHv4xrGqhgF2Ugkql+FoNU3DDcv/GN5ZOBqA:7FEaBI3YhVE5XfvvqTUgSoNYPcv/GsqA
TLSH
T1B7567D22B5018176E8C223B99AFC7B7C50BC83B1972951C377953E590670AE327F62DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\vcruntime140.dll
Size 74KB
SHA256 9ba40d6d95e33519770ad29dbbd8782e4c43e516b54bdb74eb7a4a1d0d182515
MD5 9922c6c59821a86c3279a859c3df424d
SHA1 ca946c0c8bf1d566d25827891a578fa9b121c88a
SHA512 0cd62db7a1ceace24ed3427839987fec29aa04ae50b7ca516ef1641210b33dfecb7ac85d79ff460724d990ead2b9e620f6e6cfd968c20185ef47d0d526aef2f2
SSDEEP 1536:lgMc6xv5M5Ot/MCsjw0BuRK3jteIcecbAos86D/7OAM6T4:lgM15MQt/zqw+IqaecbAos8q/3m
TLSH
T1F8739E22B0D240BFC56A857962A7AB12573DA9204FF1CFD76F9849445F78AC2F730227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\verify.dll
Size 48KB
SHA256 273d90f331ce6a8719c15a98b92fb31b0627bdf346c60ed54b48783e3d0e5db8
MD5 490142edccd3dbc6712d049727238bea
SHA1 801851320b01a64daf49a72384ef5aa957b003d3
SHA512 d893f74660068c837e163584d5a2fe147acf75f626dbeafd932477e09a39dc983a7cc69b6ecf117934e6053b292713345692aac86385234829971570954f1c0f
SSDEEP 1536:qegRW89hLzi5wL+bfM6vi6ltg20OqvW/7OAb1:e4mvT6bbi6ltg20tO/3p
TLSH
T1E0237D42D9F905BEDE9BC53131F5933DCBB8B90126D0C583EFA28A81CF51701AB255BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\bin\zip.dll
Size 81KB
SHA256 c4b196a0f603158b23fb4c439dfdad0ff1bf5845f352cd7534e74d820963472f
MD5 c0fc334e6374b3610bd1051934741b44
SHA1 c20799b7c69d43e134ab940891c14647fdcc0da4
SHA512 329f049659de575f41f350d80bdc5c5709e50075523ef5069bfa0ec3de6c7a65acc9d3b2f9ae954bc3a8f0f65ebcafc9fe8a3c14e083aaddb0867c169d740772
SSDEEP 1536:eggsS6Ic6Sij15GlepSkLPGIOQIO18TP763fj5/7OAnOJ0D:zQi0cepBAG18TT639/3nOKD
TLSH
T14383BED2BAA19AD3EFB5153090E6DB3D933EB51048804F93938DA741085B722AF727CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accessibility.properties

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\accessibility.properties
Size 149B
SHA256 68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf
MD5 2ed483df31645d3d00c625c00c1e5a14
SHA1 27c9b302d2d47aae04fc1f4ef9127a2835a77853
SHA512 4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da
TLSH
T174C02B03F08E17B95C0C18FB01DCD4C0B38049CFC029530F54E6213A6781C38008846F
MD5 SHA1 SHA512 TLSH

Submit Download

currency.data

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\currency.data
Size 4KB
SHA256 367f28fa49acd62013ae0b284261b62d39a52081bad92283b1ee75abcc19f48f
MD5 a1f6a7597ff23c6bcdc5b672922dacf8
SHA1 99ca0d4c3ec02afedbfc24002cc8e72f03c9bb86
SHA512 78d68cad85e334513f21e93df50ea96c770dc03926a9a4a2e5993fdacb1b9d471cb950f9b2491149f7e0fa4a734260dfc39181294be95662f1965902fbaa8122
SSDEEP 48:HlWAFFGFSupi9Xb6OtF8iXh8kkC6/q0X8/bVdxeI0fBE:HlWAEi9Xb6OtDXh8kk4/pd9kC
TLSH
T18C815603AAA55B67E41F1731DCCE52A47933CC014B57C617A994B62D3BFA3E06BC2480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jfxrt.jar

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\ext\jfxrt.jar
Size 8.6MB
SHA256 6e5f3bb2baf58b168dc5fb775069e757692c2cc95b88fae9bdc9401c78434e88
MD5 b5e71a03229127a9d81ae38c1dd93fbd
SHA1 07a5271c81e2c81f19cc00a4d527921cc55caa9d
SHA512 962c46cb00340c3fadc1c4e36540f81ab8bff4bc8860aacb8358c9d21e7a459f53cb6ed35e6a5ca5ac2ef6b2de2f015149ad396dfddbf2947ab5cab53ddd91d4
SSDEEP 98304:/td0fWsBomRlUcduJSfBDz3TWwrVp08EET/hW1sslrC40AzoZQO4/JcRAiXnb9y7:FGFogOcduJUVLrkHc/YdNoZQL+n08MQg
TLSH
T1C996E123BAEFA029ED3381F7BA915B43796DA5FCD00610B515E81C87E475C1E8FA3225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meta-index

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\ext\meta-index
Size 779B
SHA256 a455613323a0a6c5c5b7a409e6dc0b998005e020b7235a19993dcadddd55239a
MD5 e671b56c5fd624be6588d4759800a836
SHA1 6cf46f863af0a5dcaf32e839666956f34f847cbb
SHA512 c83e1b652c68bb89414f39dc53e5342b1ca04917388568ed6b6ddcf51474acc2af11664f5381cba091673a51afb42d0700bbc11ba2a50689d5423fc5e0df344d
TLSH
T17D01891F86479026A6BC8ACED837E341624CD11E1011C2BE45C629CA3D89ADA2A3CF38
MD5 SHA1 SHA512 TLSH

Submit Download

fontconfig.bfc

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\fontconfig.bfc
Size 3KB
SHA256 3f1792188ae901eca47b64728776d35095dc0220d5c929d0da99a2427877c3b2
MD5 48b8858d27494a66594b59695d6dc60b
SHA1 1d3bff1e17ef6b5563cbd0762c2867b36fbdad95
SHA512 5d814990cff9f787723c629e22b30a2abfc9c8df0a712c2a7cb7b11ec52ddb083cb67c2158eeea2cc03d763aa308c9a271ac7cb7c88a96e4e4c029dd95b7656c
TLSH
T14F71BC03E4FB1319E2F6FB7166B20079CF22B891EE679EAC1051780A4BD2950DD31F26
MD5 SHA1 SHA512 TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\i386\jvm.cfg
Size 41B
SHA256 c98e70bf81f14656eaf7b37323a33e5c4ba3fe5988a8c4669030d29223a5d3d3
MD5 47d92b7e08c05a96722f32407680811f
SHA1 c8f5e1a4456abdef4c473283db0853123a7c49bd
SHA512 7e4f9548a8243053972fa8819c9dedd3456c59494e8cefa06c1c9591dfb3434ab48674756b5837ade107b1b34d931ac6cd3aae7b585a0ec6ad8f4675ed0677f8
MD5 SHA1 SHA512

Submit Download

win32_LinkNoDrop32x32.gif

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\images\cursors\win32_LinkNoDrop32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
TLSH
T100C08C88F34888828A4AD2384874138C68A4C4BB8A224B88144A2A94A2935A2C1D0302
MD5 SHA1 SHA512 TLSH

Submit Download

jfr.jar

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\jfr.jar
Size 868KB
SHA256 05fbb71ed3c7f15ff499a45730bd3d1a4d598fde57c91b514410e917fb2a29a7
MD5 b4fe3a4ddef8c9394d841e63ba138e7e
SHA1 cbcfaa04e421b8ba40e663d959e401f9dea13747
SHA512 9ef6a3068f08bd50894ce2399e73f2545b4a4e8687d41110f5a13800d8cb28669b16c90287fed4190bb198c436988b57c587769d82324fe7d995153c1704c568
SSDEEP 6144:ktQ+sMrdjNKi7aTnxb4NFQ1yltOCK1wmmNKNLZ5XxHgHkdDSEW6WfHNkbgcrFWy+:YDd4iKmQUlK1gNMjNcmFOSA
TLSH
T11615D617F0161E53E181EBBA1961072422B0E0F24187E950AF7FAD566DE31CBCE59BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meta-index

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\meta-index
Size 1KB
SHA256 dff270e76bd7d851cbcf79702aebd71122c3a9e93836ae4e9f650234a754b5c3
MD5 83964354d8e8e69dfc1001f01682bd70
SHA1 1f2012a464683ccc1c284d51b20778811641b2ee
SHA512 4be6e0c8ed2bd2f59286bbfa5041676f352e32731e070d7c26511e1e570bd8d6940ff2cc59b0e1656c9c8b3f86186a34709dbf19c303d80840307dacc39d9956
TLSH
T10441496B0287842F5E9849CBB977DB9647E8843618D863FD43E45C8179CDD4B0738A74
MD5 SHA1 SHA512 TLSH

Submit Download

resources.jar

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\resources.jar
Size 3.4MB
SHA256 972eceb4cffc236da48bb2c1d90c3326f724727e2d37c2368f12c48bc441f6f0
MD5 20ef697c807412aaeed152bc02089b36
SHA1 27011bde414930863f82df8125006cd374995176
SHA512 e5c0fce06e6c0fd74a8d48667dafecd68d18624bb04387ce4c5e64fd9fe218071397ea826e4f0fc3eb9a938c46f76756b585b9bc4f50f32894af4e58f29ba4e6
SSDEEP 49152:XQIrlAmaIZCHbyAhU4QwsChL9BKXcRueaIxtiNk3SWCnyIPPBizl47vrUQtiAEAZ:ZKlup
TLSH
T1B8F54B6FB902112BCAB340B6EC3326C7E96019B183A2D637F1EC9F663F8485D5667354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\tzdb.dat
Size 101KB
SHA256 a3a380e3f97b9b110058dfc230557a9aaf7736caca06ca98c9b48e30d99516e5
MD5 c024afc08ca138acc25e2319425db507
SHA1 4ea4a6ab9b21ae83b451cc76609f1703df92b3a6
SHA512 65a9dd84b40e8a10b85e1f99643f0adef3d4fde2c562aac0a3d595aad5e0f5ae84f4268f08a1615fa85c660b80ecc83e9a553fdf88de90cad16f337b2397511c
SSDEEP 1536:c0E7m9LMqf/oITbPYRR98XJPPafvYoj/////ZG3L6Erf9h9tOsa5dewt:cAXgITzQixPafvYo0eErf9A5oO
TLSH
T109A3A2757F7150B7B2CB4222262B5B93097DAC816FC3080679B4BD4E8A76AD7603335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\jvm\lib\tzmappings
Size 9KB
SHA256 83755efbcb24476f61b7b57bcf54707161678431347e5de2d7b894d022a0089a
MD5 62bc9fa21191d34f1db3ed7ad5106efa
SHA1 750cc36b35487d6054e039469039aece3a0cc9e9
SHA512 af0ddb1bc2e9838b8f37dc196d26024126ac989f5b632cb2a8efdc29fbce289b4d0bac587fe23f17dfb6905ceada8d07b18508db78f226b15b15900738f581a3
SSDEEP 192:qwfOC9OYOxUmHomjgDwlZ+TFXsq2H+aUHCHQj4SV0l2:qqgniTyq06a2
TLSH
T19C120F017260A6CAC5B3AC0F3B467397F416B2D81CC19B6C3A2BC76B5D059B652E1A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native.properties

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\native.properties
Size 148B
SHA256 3451cae30b1b557debdaa57187e1acc763b4dc40d343e5fb76db35f5c84424fc
MD5 b8ac164f007f3d72573ca2086dcfcd98
SHA1 6174cad0f5a8ae59dd0634e2d7d114ee6f313d3e
SHA512 3a01022111a006d0df5d9bcdef3387c3cfe5dd77dea558bb0ae124f2c85dc70b1acb008fb69b162aefb0fbb4f89738d4f6dd111539da18ea0c6ed3a619fa2fc8
TLSH
T1BDC04C887B9529376950094761E244B50855465DB0841A6983A967459229C097A51936
MD5 SHA1 SHA512 TLSH

Submit Download

startdir.txt

Path C:\Users\Admin\AppData\Local\Temp\tmpjex01\startdir.txt
Size 35B
SHA256 99bf1d0e1aff0d01d67b974154d05f07b2829c9ccd625105d6678301947d3c3d
MD5 f0d77ff34694f66fa41eab0f98efa362
SHA1 2ecc80e3560b66e79b6653b0652a9f05bee30d9b
SHA512 7e6f22fcb88f86e0c99bee650d6ab600540ddeca3301ac7c6594246a3a495edaedc7f850013f69d818f521dcf9d733ea97aaec1549be11b1abe3ee6719ec6dea
MD5 SHA1 SHA512

Submit Download

regstats.txt

Path C:\Users\Admin\AppData\Local\Temp\tmpjex02\regstats.txt
Size 79B
SHA256 e261046ce9e0dccd2c0ec6421b73e872a1e92d303429b2a7ef9ae55da750e0cb
MD5 782d29f7e555454060f1260c5cfa768e
SHA1 6b0a359556308fdd509d08bb4f8fd4c117cbcc49
SHA512 99f4a2f4c6e5b6a7409ae49d35086ed5ad6759e8fe9b0fa81df7c58916ad079884f08cc26befed64649d10feb38e7f9e9e9db5feb8ee6236c56234a7bef567cb
TLSH
T160A01225141000404445000B4E60D000076402E15AA3025907C8925013248870CB830D
MD5 SHA1 SHA512 TLSH

Submit Download

regstats.txt

Path C:\Users\Admin\AppData\Local\Temp\tmpjex02\regstats.txt
Size 110B
SHA256 13554af880db9d8f3d95224a775d4d9a5f9ca16ec5017bbe3f36298456dfb62d
MD5 866db61f8f003098f4b5d4d21a9f071b
SHA1 21984aca2706c35e2831de56a9483dccbf0da613
SHA512 071eed4b13e819141b6ddb725b468aae014960aa1c5e7ec8dc7a7486acad8cbf13111e20dbace2d30923a84546c3962e58b7b04f71fb22e0786fe59f550d59db
TLSH
T173B012851B200021EDB27A104A2748407BF967B974E2974552CCD1802326ECF80FD3CF
MD5 SHA1 SHA512 TLSH

Submit Download

specreg

Path C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
Size 69B
SHA256 3dcc1b3798b0a15647819fee1f49d630caa733e4f0e670c09910ef5010cee6ee
MD5 77d12f105f51b44b852b1649fb2be28d
SHA1 492745b446b2835745c4234aeabfa6c314b6f309
SHA512 7258de8b82f80fc5b735c10c1f088049154a4962055dd39500989fb8ced8b0c58c5c4131eced18b78df80030c998499e7b155a548c007e7b418e59f0695d9319
TLSH
T124A02222B82000C08088202E0BB0C000033803E0AF8302AA03C8E3A03338CCB0CB830C
MD5 SHA1 SHA512 TLSH

Submit Download

specreg

Path C:\Users\Admin\AppData\Local\Temp\tmpjex02\specreg
Size 103B
SHA256 fd7c73ad5d9c4fbf577b749be982a696779a52ab2aba2c09c17b1d86308ae73b
MD5 743cdcc5855902638fee41e13951c1cb
SHA1 39779d4286ea4131bf1fe4cf8fc1fe6b24c8185b
SHA512 367af10a243bfa51a7250eeb559610fd08fa257da43e8efcb0425e6ff0141d1d18a6930e33547d67eb1fc778b0b505ccaca4872e7971dd83ebc0d390f2dcfcd6
TLSH
T10CB0124165240061E9B176200727480537B953A57492974551C8D3803336ECF81783CF
MD5 SHA1 SHA512 TLSH

Submit Download

windir.txt

Path C:\Users\Admin\AppData\Local\Temp\tmpjex02\windir.txt
Size 13B
SHA256 47f9b65c408bb54c3d541572850b26da0f78fe4071f01ea4601dd035297ff7af
MD5 de2436e56c86b97960ba5c1e09095256
SHA1 91ed3679a269995d2c2d061c2bd719a133cb6f09
SHA512 6ce1b0b536927f8eecbb4d00b5ff816e0fcc80f98d2f16de45049a50c5b3f56398813ee0effa7c0af192b58e3052b9c0e7647f79567229824966349f052961e6
MD5 SHA1 SHA512

Submit Download

winenv.txt

Path C:\Users\Admin\AppData\Local\Temp\tmpjex02\winenv.txt
Size 5B
SHA256 44cc1b7ceaa8a6d0bc79ba46d15e0e6b97c6a98e6fc29cdc1d5a594df70c2cac
MD5 25ee05289997f9e6ac60a1163a28fad1
SHA1 c1ef777a86275b02a77d28eef6f96ae18f9c0d5e
SHA512 1d3924d11bde7d13faa7d2a289c80b87835336d2879852bbec45ef1078a36ea44689616f17c0b4f6cc2621fbd4c8d74dc5f08d8bed70d2fda7a531722b48eb97
MD5 SHA1 SHA512

Submit Download

Uninstall.exe

Path C:\eSubApps\eSub_v3\Uninstall.exe
Size 138KB
SHA256 b604f946904da44b33b43af0b3a6602103951e7ad4a6264f89563a30931691c8
MD5 a591cffe1779fe45cd8d3ea84e453181
SHA1 cfa4128e0d739d6147e0404a80153b62fb58975a
SHA512 838d56660e4104aa8c5d31bbf350c9ff59cf15caa165acf58ab44ec48535767e2441ca6db0d790cc03207d831ffb8cbef0305b259f624cc616acc922fa4cd04e
SSDEEP 3072:z6ncMQ4en8IWKuGUgUEIQ+Qjlyv3sG3NiGNmOdT2GusIKpvVAOv/5T3Eoj7FH+qe:D1nWmUgbIQjZyTiGNmOdT2GusIKpvVAZ
TLSH
T128D3B5907A85DCA7ED141278C9A6C2F6122DBDD0C6D28B4353657F3A3B33A81BDC5236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deletable

Path C:\eSubApps\eSub_v3\data\support\spell\local\deletable
Size 4B
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
MD5 SHA1 SHA512

Submit Download

deleteMe.JexTest

Path C:\eSubApps\eSub_v3\deleteMe.JexTest
Size 1B
SHA256 d0752b60adb148ca0b3b4d2591874e2dabd346373e731c27463d65b449cc234c
MD5 9d5a273e0fb6aebca825009ee2363e2c
SHA1 132ccf0bbeffce4af8e88c1c38cb67d38432976f
SHA512 957808f7366fcc0b073935d9c956cc135117f172916f947944dd2907e498d7eeba15f9b889065b040eef8340f55280e82de7fccc4f0320870d679532d5da9eca
MD5 SHA1 SHA512

Submit Download

US_export_policy.jar

Path C:\eSubApps\eSub_v3\jvm\lib\security\policy\limited\US_export_policy.jar
Size 619B
SHA256 8e4ed2ffa1c37a25636992fd5a29702e8fd71ab330afc8d03c53a9309a8e5eea
MD5 087bb3387e066b7af44b00b25af5d14f
SHA1 7abc4b5ee915d6f232f3f0c549becf10f32f053a
SHA512 431182d9fb445951b860639a6639c2f41db200c67bacdeb42a3840f5b2b6b05d9bf1803c934dae378ac61c9939b5296cf7eb0f6570c7abfead890ea8cc9b6881
TLSH
T1E1F0843AAED8C801D25A92B102C38306E766289C325C56CB8A41D2300934E804BCBDEA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1884-3-0x000000000041F000-0x0000000000420000-memory.dmp

Download

memory/4116-912-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-935-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-622-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-1329-0x00000000025B0000-0x00000000027F0000-memory.dmp

Download

memory/4116-1328-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-1283-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-1279-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-501-0x00000000025B0000-0x00000000027F0000-memory.dmp

Download

memory/4116-515-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-549-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-592-0x00000000025B0000-0x00000000027F0000-memory.dmp

Download

memory/4116-897-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-903-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-905-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-909-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-551-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-914-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-937-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-936-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-648-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-917-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-951-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-571-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-1160-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-1157-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-1193-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4116-1191-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/4860-591-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4860-593-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4860-594-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4860-499-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4860-1253-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4860-595-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4860-596-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4860-597-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4860-1318-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4860-598-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4860-599-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4860-1334-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4936-1335-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads